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FIG. 7 



RECEPTION OF A NEW 
VISITIG MEMBER 



NO 



-REQUEST A NEW TEK 
-GENERATE A NEW TEK 
-ENCRYPT NEW KEK 
USING CURRENT KEK 
-MULTICAST THE ENCRYPTED 
KEK TO ALL THE AREA 
MEMBERS 

-RESET EKOL AND VKOL 
LISTS 

-UNICAST THE NEW KEK TO 
JOINING MEMBER USING A 
SECURE CHANNEL 
-CALL TEK_FORWARDING 
PROCESS 




THE ENTERING MEMBER IS 
REMOVED FROM VKOL/EKOL 



-GENERATE YEK 
-VEK_CHANGE=FALSE 

=j=o- 




NO jr 




-VEK=DERIVE{VEK) 
-VEK CHANGE=TRUE 



UNICAST VEK TO THE | 
ENTERING MOBILE MEMBER I 

1' 





CURRENT TEK IS OPTIONALLY 
SENT TO ENTERING 
MOBILE MEMBER 
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FIG. 9 



-ENCRYPT TEK WITH KEK 
-MULTICAST ENCRYPTED TEK 
TO AREA MEMBERS 



RECEPTION OF NEW TEK 




-ENCRYPT TEK WITH KEK 
-ENCRYPT TEK WITH VEK 
-j++.//jINITIALIZEDTO 0 
-IF j=2{TEK_ENCRYPTED_BY_ 
VEK=TRUE; j=0;f 
-MULTICAST ENCRYPTED TEK+ 
"VEK_CHANGE" VALUE TO 
AREA MEMBERS 



RECEPTION OF A NEW TEK | 




DECRYPT THE NEW TEK 
USING KEK 



VEK=DERIVED(VEK) 



-DECRYPT THE NEW TEK 
USING VEK 

-VEK_USED=TRUE; (CURRENT 
VEK WAS USED TO DECRYPT 

THE TEK) 
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